npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11065 blocks this version. Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install ti...

OpenSSF/OSV malware advisory MAL-2026-11064 blocks this version. On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home di...

OpenSSF/OSV malware advisory MAL-2023-8293 blocks this version. index.js runs automatically via a preinstall lifecycle hook on `npm install` and collects host identifiers from the install...

OpenSSF/OSV malware advisory MAL-2023-1491 blocks this version. The package's preinstall hook auto-executes index.js on `npm install`. The script imports `https` and `os`, collects `os.ho...

OpenSSF/OSV malware advisory MAL-2026-11055 blocks this version. On npm install, the package's preinstall lifecycle executes index.js which collects os.hostname(), os.platform(), and os.a...

The observed top-level, obfuscated installation and execution of an unrelated remote package is concrete unconsented staged code execution, not required polyfill functionality.

The public calendar helpers conceal an import-triggered downloader and Windows persistence routine unrelated to package functionality. This is malicious behavior despite a likely implemen...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11043 blocks this version. The npm package `supplyhub` is a credential / SSH-key stealer. Its `package.json` declares a `postinstall` lifecycle hook...

OpenSSF/OSV malware advisory MAL-2026-11042 blocks this version. The npm package `faust-cont` is a supply-chain dropper disguised as a benign CLI tool (`index.js` is a decoy that only log...

OpenSSF/OSV malware advisory MAL-2026-11041 blocks this version. The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host iden...

OpenSSF/OSV malware advisory MAL-2026-11041 blocks this version. The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host iden...

OpenSSF/OSV malware advisory MAL-2026-11041 blocks this version. The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host iden...

OpenSSF/OSV malware advisory MAL-2026-11040 blocks this version. package.json declares `preinstall: node./dist/index.d.js`, which fires automatically on `npm install`. The script contains...

OpenSSF/OSV malware advisory MAL-2026-6715 blocks this version. src/index.cjs exports getPlugin(), which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax...

The native addon’s imported APIs and embedded anti-analysis/staging indicators are materially inconsistent with a buffer utility. The absence of install hooks does not mitigate import-tim...

The unconditional postinstall download of an unsigned executable from an unrelated C2-named host is concrete malicious payload staging, despite no execution call in the inspected source.